CVE-2019-13565

CWE-284 — Improper Access Control14 documents10 sources
Severity
7.5HIGH
EPSS
3.8%
top 11.89%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
9
Apple MAC OS XOracle Blockchain PlatformOpenldap Openldap+6 more
Timeline
PublishedJul 26
Latest updateMay 24

Description

An issue was discovered in OpenLDAP 2.x before 2.4.48. When using SASL authentication and session encryption, and relying on the SASL security layers in slapd access controls, it is possible to obtain access that would otherwise be denied via a simple bind for any identity covered in those ACLs. After the first SASL bind is completed, the sasl_ssf value is retained for all new non-SASL connections. Depending on the ACL configuration, this can affect different types of operations (searches, modif…

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NExploitability: 3.9 | Impact: 3.6

Affected Packages9 packages

▶Debianopenldap< 2.4.48+dfsg-1+3
▶Ubuntuopenldap< 2.4.42+dfsg-2ubuntu3.6+1
▶NVDopenldap/openldap2.0 — 2.4.47
▶NVDapple/mac_os_x10.13 — 10.13.6+4

Also affects: Debian Linux 8.0, Ubuntu Linux 12.04, 14.04, 16.04, 18.04, 19.04

Patches

Patch: www.oracle.com ↗Patch: www.oracle.com ↗Patch: www.oracle.com ↗

🔴Vulnerability Details

5
GHSA
GHSA-49q9-mmpr-r526: An issue was discovered in OpenLDAP 2↗2022-05-24
▶
OSV
openldap vulnerabilities↗2019-08-19
▶
OSV
openldap vulnerabilities↗2019-07-30
▶
OSV
CVE-2019-13565: An issue was discovered in OpenLDAP 2↗2019-07-26
▶
CVEList
CVE-2019-13565: An issue was discovered in OpenLDAP 2↗2019-07-26
▶

📋Vendor Advisories

6
Oracle
Oracle Oracle Blockchain Platform Risk Matrix: Backend (OpenLDAP) — CVE-2019-13565↗2022-04-15
▶
Apple
CVE-2019-13565: macOS Catalina 10.15.2, Security Update 2019-002 Mojave, Security Update 2019-007 High Sierra↗2019-12-10
▶
Ubuntu
OpenLDAP vulnerabilities↗2019-08-19
▶
Ubuntu
OpenLDAP vulnerabilities↗2019-07-30
▶
Red Hat
openldap: ACL restrictions bypass due to sasl_ssf value being set permanently↗2019-07-24
▶

💬Community

2
Bugzilla
CVE-2019-13565 openldap: ACL restrictions bypass due to sasl_ssf value being set permanently [fedora-all]↗2019-08-08
▶
Bugzilla
CVE-2019-13565 openldap: ACL restrictions bypass due to sasl_ssf value being set permanently↗2019-07-16
▶